実例に学ぶXSS脆弱性の発見と修正方法/line_dm 16 20160916 how to find and fix xss

by mala

Slide 1

Slide 1 text

࣮ྫʹֶͿXSS੬ऑੑͷ ൃݟͱमਖ਼ํ๏ ma.la

Slide 2

Slide 2 text

ςʔϚ • ͍͔ͭ͘ࠓ·ͰXSSʹؔͯ͠ൃද͖ͯͨ͠(AppSec,AVTokyo, etc) • ओʹ޿ൣͳαΠτʹӨڹ͢ΔϥΠϒϥϦͷ੬ऑੑͳͲΛղઆ • ࠓճ͸ൃݟํ๏΍ࣄྫʹ͍ͭͯத৺ʹղઆ • αΠτ։ൃऀଆͰͷରࡦ͕ඞཁͳՕॴ

Slide 3

Slide 3 text

Part0. XSSͬͯԿ • αʔϏεΛఏڙ͍ͯ͠ΔυϝΠϯ্Ͱɺ೚ҙͷJavaScriptίʔυ͕࣮ߦ Ͱ͖Δ੬ऑੑ • ͦͷυϝΠϯͰදࣔ͞ΕΔ৘ใΛ౪Έग़ͨ͠Γɺউखʹߋ৽͢Δ͜ͱ͕ ग़དྷΔ • डಈత߈ܸ: ඃ֐Λड͚Δͷ͸߈ܸϦϯΫΛ౿ΜͩϢʔβʔ

Slide 4

Slide 4 text

Part1. How to find XSS

Slide 5

Slide 5 text

ίʔυϨϏϡʔͷϙΠϯτ • ೖྗՕॴͱධՁ͢ΔՕॴʹ஫໨͢Δ • source ͱ sink ͱݺ͹ΕͨΓ͢Δ

Slide 6

Slide 6 text

୯७ͳXSSͷ৔߹ • αʔόʔଆͷHTML templateͰͷग़ྗՕॴɺධՁՕॴ΋ಉ͡ • ग़ྗՕॴͰhtml tag΍scriptΛදࣔ  • ίʔυΛ௥͍͚ͬͯ͹େମશ෦ݟ͔ͭΔ • Ұ෦Λআ͖ɺࣗಈΤεέʔϓͰશ෦௚Δ

Slide 7

Slide 7 text

୯७Ͱ͸ͳ͍XSSͷࣄྫ • JavaScriptίʔυͷಈతੜ੒ • URLͷՕॴʹ javascript:xxx • HTML escapeͰ๷͛ͳ͍ • DOM based XSSͱݺ͹ΕΔ΋ͷ

Slide 8

Slide 8 text

DOM based XSSͷ৔߹ • ೖྗՕॴͱධՁ͢ΔՕॴ͕ҧ͏ • JavaScriptͷίʔυΛ௥Θͳ͍ͱ෼͔Βͳ͍ • ൃݟ͕೉͍͠ݪҼ

Slide 9

Slide 9 text

ೖྗՕॴͷྫ location.* (location.href, location.hash, etc) document.* (document.URL, document.cookie, etc) window.name

Slide 10

Slide 10 text

ධՁ͢ΔՕॴͷྫ ೖྗ͞Εͨύϥϝʔλ͕ग़ྗ͞ΕΔՕॴ URLͱͯ͠ධՁɺJavaScriptίʔυͱͯ͠ධՁɺHTMLͱͯ͠ධՁ

Slide 11

Slide 11 text

URLͱͯ͠ධՁ • location.href = , iframe.src = • ajax, XMLHttpRequest ͰͷಡΈࠐΈ • etc

Slide 12

Slide 12 text

ίʔυͱͯ͠ධՁ • ίʔυΛಈతʹੜ੒͢ΔΑ͏ͳ࢖͍ํ (͋·Γແ͍) • eval() • จࣈྻͰͷ setTimeout() setInterval() (͋·Γ࢖ΘΕͳ͍) • Function() (͋·Γ࢖ΘΕͳ͍) • etc

Slide 13

Slide 13 text

HTMLग़ྗ • innerHTML = • document.write() • jQuery() $() $(el).html() • ֤छςϯϓϨʔτΛ࢖ͬͨग़ྗ • etc

Slide 14

Slide 14 text

ίʔυͷྲྀΕΛ௥͍ͬͯ͘ • ag ͳͲͷίʔυݕࡧπʔϧΛ࢖͏ • ҆શͩͱ֬ೝ͕Ͱ͖ͨ৔ॴ͸আ֎͍ͯ͘͠ • ag innerHTML | ag -v "safe" • ೖྗՕॴɺग़ྗՕॴɺͲͪΒ͔ΒͰ΋ո͍͠Օॴ͸ݟ͔ͭΔ

Slide 15

Slide 15 text

ݟམͱ͕ͪ͠ͳϙΠϯτ

Slide 16

Slide 16 text

document.cookie / localStorage • ݕࡧΩʔϫʔυ΍ཤྺΛอ࣋͢Δػೳ • ೚ҙͷ஋Λอଘग़དྷΔ͜ͱ͕͋Δ • ೖྗ࣌ͱग़ྗ࣌Ͱ͕࣌ؒࠩൃੜ͢Δ͜ͱ͕͋Δ

Slide 17

Slide 17 text

Persistent DOM XSS • DOM based XSSͷӬଓԽ͕Մೳ • cookie / localStorageʹ߈ܸ༻ͷίʔυΛอଘ • දࣔ͢Δͨͼʹ࣮ߦ͞ΕΔΑ͏ͳέʔε • → ࣗࣾͰͷࣄྫ΍ɺ޿ࠂωοτϫʔΫͷiframeͰ࣮ྫ͋Γ

Slide 18

Slide 18 text

ಛʹ cookie ͷ৔߹ • αϒυϝΠϯ͔ΒͰ΋ઃఆ͕Մೳ • vuln.example.com → .example.com • ੬ऑੑͷ͋ΔαϒυϝΠϯ͔ΒcookieΛset  • ߈ܸର৅ͷυϝΠϯͰ cookie ىҼͷ DOM based XSS  • MITM attackͰ΋cookieͷઃఆ͕Մೳ

Slide 19

Slide 19 text

CookieΛ࢖ͬͨ߈ܸ (XSS or ServerSide) • ͦͷαʔϏεͰ͸৴༻Ͱ͖Δ஋͔͠ग़ྗ͠ͳ͍৔߹Ͱ΋XSSՄೳ • MITMͰͷcookieઃఆ → HSTS include subdomainΛ࢖Θͳ͍ͱ๷͛ͳ͍ • JS Ͱ΋serverͰ΋৴པͰ͖ͳ͍஋͕ೖΔ͜ͱΛલఏʹઃܭ͢Δඞཁ͕͋Δ  • ࡉ޻ͨ͠cookieΛ࢖ͬͨremote code executionͷࣄྫ͍͔ͭ͋͘Γ

Slide 20

Slide 20 text

Part2. मਖ਼ํ๏

Slide 21

Slide 21 text

ग़ྗՕॴʹԠͯ҆͡શʹ͢Δ • ධՁ͞ΕΔίϯςΩετʹԠͯ͡ରࡦ͸ҧ͏ • શͯʹରͯ͠༗ޮͳvalidation΍escape rule͸ଘࡏ͠ͳ͍ • յΕͯ΋ྑ͍ͳΒҰ཯ϑΟϧλ͢ΔΑ͏ͳॲཧ͸࡞ΕΔ  <> ͕ೖྗ͞Ε͍ͯΔͱ໰౴ແ༻ͰΤϥʔʂ

Slide 22

Slide 22 text

JavaScriptͷม਺ग़ྗ • ͦ΋ͦ΋ආ͚Δ • data-xxx="html escaped value" ͰຒΊࠐΈΛਪ঑ • ಉ͡escape ruleͰରԠՄೳɺίϯςΩετΛҙࣝ͠ͳ͍͍ͯ͘ • Ͳ͏ͯ͠΋ඞཁͰ͋Ε͹ɺhtml escapeͰ͸ͳ͘js escape

Slide 23

Slide 23 text

URLΛग़ྗ͢Δ৔߹ • javascript: xxx ͕ೖͬͯ͸͍͚ͳ͍ • ̋ validation ruleΛ࡞ͬͯద༻͢Δ • HTML Escape / JS escape ͚ͩͰ͸ෆे෼ • URLΛೖग़ྗ͢ΔΑ͏ͳՕॴ͸ɺͲͷΈͪvalidation͕͋Δ͸ͣ

Slide 24

Slide 24 text

ίʔυΛੜ੒͢Δ৔߹ • eval() ͦ΋ͦ΋࢖Θͳ͍Α͏ʹ͢Δ • JSON.parseͷ୅༻ͱͯ͠ɺͨ·ʹݟΔ  → ΋͏͍Βͳ͍ɺpolyfill࢖༻͢Ε͹Α͍

Slide 25

Slide 25 text

HTMLΛग़ྗ͢Δ৔߹ • innerHTMLΛͳΔ΂͘࢖Θͳ͍(࠷ऴతͳग़ྗ࣌ͷΈ) • ࣗಈescapeՄೳͳtemplate engine࢖͏ → mustache ͳͲ • jQuery ͷ html() → ෆཁͰ͋Ε͹ text() ʹஔ͖׵͑Δ • html() ͷଟ༻͸ϨϏϡʔͷෛ୲ʹͳΔ

Slide 26

Slide 26 text

XSSͷݟ͚ͭํͱ௚͠ํ͸ಉ͡ • ag ͳͲͷίʔυݕࡧπʔϧΛ࢖͏ • ҆શͩͱ֬ೝ͕Ͱ͖ͨ৔ॴ͸আ֎͍ͯ͘͠ • ag innerHTML | ag -v "safe" • ೖྗՕॴɺग़ྗՕॴɺͲͪΒ͔ΒͰ΋ո͍͠Օॴ͸ݟ͔ͭΔ

Slide 27

Slide 27 text

मਖ਼ํ๏ͷϙΠϯτ • ։ൃऀ͔Βݟͯ҆શ != ϨϏϡΞʔ͔Βݟͯ҆શ  • ։ൃऀ͸ةݥ͕ແ͍ύϥϝʔλͱ஌͍ͬͯͯ΋ύοͱݟͰ͸Θ͔Βͳ͍  • ιʔείʔυݕࡧͰɺո͍͠Օॴ͕ݟ͔ͭΒͳ͍ঢ়ଶ • ϨϏϡʔ͠΍͍͢ίʔυʹ͢Δ → ࣗ෼Ͱ΋ίʔυݕࡧͯ͠ΈΔͱྑ͍

Slide 28

Slide 28 text

Part3. ൃੜཁҼͷ܏޲ • ͲͷλΠϛϯάͰԿʹ஫ҙ͢Ε͹ྑ͍ͷ͔෼͔Βͳ͍ • ةݥͳ͜ͱΛ͍ͯ͠Δ͕֮ࣗͳ͍ • ʮԿΛ͠Α͏ͱͯ͠ى͖ͨͷ͔ʯΛओ࣠ʹղઆ

Slide 29

Slide 29 text

ࣄྫ: ݕࡧΩʔϫʔυͷදࣔ • ϦϑΝϥ͔Βऔಘ • ݕࡧΫΤϦ͔Βͷऔಘ • ޿ࠂ࠷దԽ༻ͷύϥϝʔλ΍ΩʔϫʔυϋΠϥΠτͰ࢖͍ͬͯͨ • ऩӹ૿ՃͷͨΊʹ͋ΒΏΔαʔϏεʹXSS͕௥Ճ͞Ε͍ͯͨ

Slide 30

Slide 30 text

۩ମྫ var keyword = '[% param.keyword | html %]'; // ͜Ε͕  ↓  var keyword = ''; alert(1); ''; // ͜͏ͳΔ • ౰࣌࢖͍ͬͯͨςϯϓϨʔτΤϯδϯ͕ɺγϯάϧΫΦʔτΛΤεέʔ ϓ͠ͳ͔ͬͨ • ࠓͰ͸͋·ΓΈͳ͍ • ϦϑΝϥ͔Βऔಘ͢Δ΋ͷ͸ → DOM based XSSʹ

Slide 31

Slide 31 text

ϦϑΝϥΛ࢖ͬͨXSS • ϦϑΝϥ͔ΒΩʔϫʔυऔಘͯ͠Φεεϝهࣄදࣔ • ϦϑΝϥʹ ه߸΍HTMLλά͕ೖΔ͜ͱΛ૝ఆ͍ͯ͠ͳ͍

Slide 32

Slide 32 text

ֶͼ • ϓϥεΞϧϑΝͷػೳͰXSS͕ى͖͍ͯΔ • αʔϏεͷຊମͷػೳ͡Όͳ͍෦෼Ͱ͍ͭͷؒʹ͔XSS͕ग़དྷͯΔ • ։ൃ͸ऴΘͬͯΔΜ͚ͩͲɺ༉அͯ͠Δͱ͜ΖͰɻɻ • ιʔγϟϧϘλϯ௥Ճ → ݱࡏͷURLΛdocument.writeͰग़ྗɺ౳

Slide 33

Slide 33 text

ࣄྫ: HTML EntityͷղऍΛ͍ͨ͠ • $(el).text() Λ࢖ͬͯද͍ࣔͯͨ͠Β HTML࣮ମࢀরɺ਺஋ࢀরจࣈ͕ද ࣔ͞Εͳ͘ͳͬͨ • ͜͏͍͏ͷͶ B'z → B'z • → $(el).html() ʹมߋ΍ɺࣗಈΤεέʔϓ֎͢ॲཧΛೖΕͯ͠·͏ • Ϣʔβʔೖྗ͕ೖΒͳ͍͔Ͳ͏͔֬ೝ͕ඞཁ • ҆શͳೖྗՕॴͰ͋ͬͯ΋ϨϏϡʔ͕େมʹͳΔ

Slide 34

Slide 34 text

Ͳ͏͢Ε͹ྑ͍ʁ • HTML entityͷղऍͷͨΊʹɺhtml() Λ࢖Θͳ͍ɻ • html() Λ࢖͏ͱɺ͋Δ೔ಥવةݥʹͳΔ • ඞཁͳॲཧ͸htmlग़ྗͰ͸ͳ͘ɺdecode html entities • textarea hack $("").html(value).text()

Slide 35

Slide 35 text

ࣅͨࣄྫ: escapeํࣜͷมߋ • αʔόʔαΠυͰ΋ΤεέʔϓɺjsͰͷग़ྗͰ΋Τεέʔϓ • ೋॏescapeʹͳͬͯ͠·ͬͨʂ & ΍ " ͳͲ͕ը໘ʹදࣔ͞Ε Δ • html escape → js escape ΁ͷมߋ • ͜Εࣗମ͸ਖ਼͍͕͠ɺຊ౰ʹେৎ෉ʁ

Slide 36

Slide 36 text

escapeํࣜมߋʹ൐͏໰୊ • A: ̋ js escapeͰม਺ຒΊࠐΈ → js templateͰauto escapeͰදࣔ • B: ˚ html escapeͰม਺ຒΊࠐΈ → js templateͰauto escapeͰදࣔ →   ೋॏescape • C: ☓ js escapeͰม਺ຒΊࠐΈ → innerHTML ΍ $() html() Ͱग़ྗՕॴ͕͋Δ

Slide 37

Slide 37 text

Կ͕໰୊͔ʁ • ೋॏΤεέʔϓ͸όά͚ͩͲ XSS ͸੬ऑੑ • B → C ʹѱԽ͢ΔՄೳੑ͕͋Δ (όάΛ௚ͯ͠੬ऑੑ͕ൃݱ) • पลՕॴͷϨϏϡʔ΋ηοτͰߦΘͳ͍ͱμϝ

Slide 38

Slide 38 text

ֶͼ • ද͕ࣔόάͬͯ·͢ → ҰൠϢʔβʔ΍QA͔Βͷใࠂ • ରॲྍ๏తʹ௚͢ɺ෼͔ͬͯΔਓ͕ϨϏϡʔ͠ͳ͍··ద༻ • ೋॏΤεέʔϓόά͕XSSͱͯ͠ѱԽͯ͠͠·͏ • ௚ͨ͠ຊਓ͸όάΛ௚ͨͭ͠΋Γ

Slide 39

Slide 39 text

ࣄྫ: ίϝϯτΞ΢τ ׂͱ௝͍͠λΠϓ

Slide 40

Slide 40 text

JavaScriptதͷม਺ग़ྗՕॴͷίϝϯτΞ΢τ • /* */ Λ࢖͏έʔε • */ ΛೖΕΔ͜ͱͰίϝϯτΛڧ੍ऴྃ͢Δ /* var keyword = '[% keyword %]' */ ↓ /* var keyword = '*/ alert(1) /*' */

Slide 41

Slide 41 text

// Λ࢖͏έʔε • վߦͰಥഁՄೳ // var keyword = '  alert(1)//‘ • U+2028 / U+2029 Ͱ΋ಥഁՄೳ • վߦΛϑΟϧλͳΜͯத్൒୺ͳ͜ͱ͸͠ͳ͍Α͏ʹɻ

Slide 42

Slide 42 text

ίϝϯτΞ΢τ໰୊ • jsͷಈతੜ੒ɺม਺ຒΊࠐΈΛ΍ΊΔɺͱ͍͏ݪଇͰରԠՄೳ • ม਺ग़ྗՕॴͷจ຺Λҙࣝ͢Δ͜ͱͰ๷͙ → ೉͍͠  • JavaScriptத͔ͩΒjs escape!! ͱ͍͏ܒ໤͕ग़དྷ͍ͯͯ΋ൃੜ͢Δ • ͦ΋ͦ΋ίϝϯτΞ΢τ͠ͳ͍Ͱؙ͝ͱফ͢ɺgitʹϩά࢒Δ

Slide 43

Slide 43 text

ࣄྫ: ίϯςϯπͷಈతͳϩʔυ • HTMLஅยΛදࣔ͢ΔΑ͏ͳέʔε • Single page appͷྲྀߦͰଟ͘ͳͬͨ → router͕ͪΌΜͱॻ͔Ε͍ͯ Ε͹੬ऑੑ͸গͳ͍ • ͪΐͬͱલʹ࡞ΒΕͨΑ͏ͳαΠτɺlocation.hash ͔Βऔಘ • ΞχϝެࣜαΠτ΍ϥϯσΟϯάϖʔδͳͲͰΑ͘ݟΔ

Slide 44

Slide 44 text

HTMLஅยϩʔυͷ໰୊఺ • ಉҰυϝΠϯʹ੍ݶ͍ͯͯ͠΋҆શͰ͸ͳ͍έʔε͕͋Δ • ಉҰυϝΠϯʹΦʔϓϯϦμΠϨΫλ • ಉҰυϝΠϯͰ <> ΛؚΉίϯςϯπΛಈతੜ੒Մೳ(JSONP API౳) • ඞཁͳ͜ͱ → ૝ఆͨ͠path͔Ͳ͏͔ͷݫ֨ͳνΣοΫ

Slide 45

Slide 45 text

ϥΠϒϥϦͰͷ໰୊ • ಉҰυϝΠϯͷίϯςϯπ͸҆શͰ͋Δɺͱ͍͏ࢥ͍ࠐΈ • jQuery mobile → ϋογϡࢦఆͰಉҰυϝΠϯ಺ϩʔυ • Rails ͷ turbolinks → ϦϯΫઌΛAjaxͰಡΈࠐΜͰߴ଎Խ • ύονॻ͍ͨΓͨ͠ (ಈతϩʔυΛߦͳ͏content-typeͷ੍ݶ)

Slide 46

Slide 46 text

·ͱΊ • XSS͸΍΍ͯ͘͜͠೉͍͠ • ҆શʹ͢ΔͨΊͷγϯϓϧͳݪଇ͸͋Δ • ಈతͳίʔυੜ੒Λආ͚ΔɺࣗಈΤεέʔϓΛ࢖͏ • + ݪଇΛ֎Εͨ࣌ʹةݥͩͱ࡯஌͢Δηϯε͕ඞཁ